Staff Vulnerability Management Engineer
Chainguard2 months ago
Remote, CanadaStaff+
Responsibilities
- Own measurement, disclosure, and reporting for a pipeline of thousands of novel vulnerabilities identified weekly.
- Calibrate vulnerability response processes based on emerging trends.
- Report newly discovered vulnerabilities to upstream projects and maintainers.
- Run the CNA program and assign new CVEs when necessary.
- Coordinate internal and external embargoes with customers, engineering teams, and external maintainers.
- Coordinate actions and responses with the Linux Foundation, CISA, and other industry bodies.
- Guide industry direction so emerging standards and norms meet customer needs.
- Represent Chainguard externally in its vulnerability management efforts.
- Work with AI model vendors to guide the evolution of the software supply chain.
Requirements
- 7+ years of experience in software security, open source maintenance, or vulnerability disclosure management.
- Strong understanding of responsible disclosure.
- Practical expertise automating pipelines and processes at large scale to reduce human involvement.
- Deep experience with open source communities.
- Experience coordinating with public-sector organizations, industry standards bodies, and working groups.
- Preferred thought leadership in vulnerability disclosure management and embargoes.
- Familiarity with Chainguard Images or other minimal and hardened container base image ecosystems.
- Experience operating a CNA.
- Software engineering background in Python, Java, JavaScript, Go, or similar languages.
- Background in security research, penetration testing, or bug bounty programs.
Benefits
- Flexible remote-first work with team meetups, bi-annual destination summits, and a monthly coworking, phone, and internet stipend.
- Stock options upon hire and promotion, secondary offering participation, and a 10-year exercise window.
- 100% covered health, vision, and dental insurance premiums for the employee and dependents.
- Flexible paid time off.
- 18 weeks of paid parental leave for birthing parents and 12 weeks for non-birthing parents.
About Chainguard
Chainguard provides secure, hardened container images and production-ready builds of open source software for enterprises and developers, typically sold via subscriptions and support. Its offerings include Chainguard Images and tools for software supply chain security; the company also maintains Wolfi, a container-focused Linux distribution. Founded in 2021 and headquartered in Kirkland, WA, Chainguard’s customers include organizations such as OpenAI, Snowflake, and Hewlett Packard Enterprise.